Should I remove/update libssl0.9.7 ?

[kai12]

Hi all,

I just stumbled across a libssl0.9.7 on my etch system. I am aware
of the security issues with libssl0.9.8 and I have updated the relevant
packages and regenerated my keys, there seem to be no vulnerable
keys left on my machine. So far so good.

My question: is it a reason for concern to have the older 0.9.7 version
on the system?

It's apparently required by liblrdf0, "a library to manipulate RDF files", I
don't know what it does and whether I need it.

Thanks, kai

[kai12]

On Debian -- Security*Information -- DSA-1571-1 openssl:

It is strongly recommended that all cryptographic key material which has been generated by OpenSSL versions starting with 0.9.8c-1 on Debian systems is recreated from scratch.

and

The first vulnerable version, 0.9.8c-1, was uploaded to the unstable distribution on 2006-09-17

So I can answer my own question: the old 0.9.7 should be free of the security issue.

cheers, kai